Security Policies for Security Policies for Institutions of Higher Institutions of Higher

EducationEducation

Ardoth A. Hassler, Associate VP for University Ardoth A. Hassler, Associate VP for University Information Services, Georgetown University Information Services, Georgetown University

Tracy B. Mitrano, Director of IT Policy and Computer Tracy B. Mitrano, Director of IT Policy and Computer Policy and Law Program, Cornell University Policy and Law Program, Cornell University

May 17, 2004May 17, 2004

AbstractAbstract

Security policies are an important Security policies are an important component of an overall security strategy. component of an overall security strategy. This presentation will describe the security This presentation will describe the security policies of Georgetown University and policies of Georgetown University and Cornell University. It will include a Cornell University. It will include a discussion of the policy development discussion of the policy development process, lessons learned, efforts to inform process, lessons learned, efforts to inform users, and policy impact. users, and policy impact.

May 17, 2004May 17, 2004

Higher Ed IT EnvironmentsHigher Ed IT Environments

Historically “open” network environmentsHistorically “open” network environmentsWide range of hardware and software from outdated to Wide range of hardware and software from outdated to state-of-the-artstate-of-the-artIncreasing demands for distributed computing, distance Increasing demands for distributed computing, distance learning and mobile/wireless capabilities which create learning and mobile/wireless capabilities which create unique security challengesunique security challengesLack of clearly defined security requirements (what do Lack of clearly defined security requirements (what do we need to protect and why)we need to protect and why)Experimentation and anonymity highly valued (easy Experimentation and anonymity highly valued (easy access in opposition with responsibility and security)access in opposition with responsibility and security)Students and staff with little or no security trainingStudents and staff with little or no security trainingPersistent belief that security & academic freedom are Persistent belief that security & academic freedom are antitheticalantithetical

EDUCAUSE/NSF Scan of Higher Education IT/Data Environments, August 2002

May 17, 2004May 17, 2004

Don’t forget….Don’t forget….

LawsLaws

RegulationsRegulations

ContractsContracts

Other campus policies…Other campus policies…

May 17, 2004May 17, 2004

GU’s Policy Development ProcessGU’s Policy Development Processhttp://www.georgetown.edu/policy/technology/process.htmhttp://www.georgetown.edu/policy/technology/process.htm

1.1. Articulate a clear, concise rationale for the Articulate a clear, concise rationale for the establishment of the policy or guidelines.establishment of the policy or guidelines.

2.2. Identify the “process or executive sponsor(s).”Identify the “process or executive sponsor(s).” 3.3. Establish the working group.Establish the working group. 4.4. Establish a timeline.Establish a timeline. 5.5. Determine whether an interim policy or guidelines Determine whether an interim policy or guidelines

are needed.are needed. 6.6. Establish the approval process.Establish the approval process. 7.7. List all other (potentially) affected policies and List all other (potentially) affected policies and

guidelines.guidelines.

May 17, 2004May 17, 2004

GU’s Policy Development ProcessGU’s Policy Development Process

GoodGood We have a process!We have a process! Helps with campus-wide issuesHelps with campus-wide issues We don’t have a central policy officeWe don’t have a central policy office

Not so goodNot so good We don’t have a central policy officeWe don’t have a central policy office Harder to coordinate with other policy makersHarder to coordinate with other policy makers Other units don’t have defined policy processesOther units don’t have defined policy processes Lack of common terminologyLack of common terminology

May 17, 2004May 17, 2004

Cornell University Policy ProcessCornell University Policy Process

ProcessProcess Impact StatementImpact Statement Executive Policy Review GroupExecutive Policy Review Group Policy Review GroupPolicy Review Group Executive Policy Review Group finalExecutive Policy Review Group final

PromulgationPromulgation

Education Education

ImplementationImplementation

May 17, 2004May 17, 2004

Cornell University Policy ProcessCornell University Policy Process

GoodGood Legitimates policy Legitimates policy Provides processProvides process Harmonizes policy across organizationHarmonizes policy across organization

Not so GoodNot so Good Finance centricFinance centric Limited representation, and buy inLimited representation, and buy in Creates more challenges for IT policyCreates more challenges for IT policy

May 17, 2004May 17, 2004

Security ofInformation Technology

Resources

Responsible Use ofInformation Technology

Resources

EncryptionKey Escrow

Recording and Registrationof Domain Names

ReportingSecurityIncidents

NetworkRegistry

Authentication and Authorization

Access toElectronic

Mail

Privacy of Networkand Network

FlowLogs

Use of EncryptionEscrowKeys

Mass ElectronicMailing

Network Registry

Color Key

Bright Green: ExistingUniversity Policy

Turquoise: Existing Policy,scheduled for revision

Light Green: EPRGapproved, scheduled forpromulgation early 2004

Light Yellow: PAGapproved, schedule for

EPRG review early 2004Tan: Impact Statementapproved, drafting with

stakeholdersBright Blue: OIT drafting

impact statement

May 17, 2004May 17, 2004

Georgetown’s “Statement”Georgetown’s “Statement”

The Georgetown University Information Security Policy (the “Policy”) The Georgetown University Information Security Policy (the “Policy”) serves to create an environment that will help protect all members of serves to create an environment that will help protect all members of the Georgetown University community (the “University”) from the Georgetown University community (the “University”) from information security threats that could compromise privacy, information security threats that could compromise privacy, productivity, reputation, or intellectual property rights. The Policy productivity, reputation, or intellectual property rights. The Policy recognizes the vital role information plays in the University’s recognizes the vital role information plays in the University’s educational, research, operational, and medical advancement educational, research, operational, and medical advancement missions, and the importance of taking the necessary steps to missions, and the importance of taking the necessary steps to protect information in all forms. As more information is used and protect information in all forms. As more information is used and shared by students, faculty and staff, both within and outside the shared by students, faculty and staff, both within and outside the University, a concomitant effort must be made to protect University, a concomitant effort must be made to protect information. The Policy serves to protect information resources from information. The Policy serves to protect information resources from threats from both within and outside of the University by setting forth threats from both within and outside of the University by setting forth responsibilities, guidelines, and practices that will help the University responsibilities, guidelines, and practices that will help the University prevent, deter, detect, respond to, and recover from compromises to prevent, deter, detect, respond to, and recover from compromises to these resources, and to foster an environment of secure these resources, and to foster an environment of secure dissemination of information.dissemination of information.

May 17, 2004May 17, 2004

Cornell’s StatementCornell’s Statement

Cornell University expects all individuals using Cornell University expects all individuals using information technology devices connected to the information technology devices connected to the network to take appropriate measures to network to take appropriate measures to manage the security of those devices. manage the security of those devices.

The university must preserve its information The university must preserve its information technology resources, comply with applicable technology resources, comply with applicable laws and regulations, and comply with other laws and regulations, and comply with other university or unit policy regarding protection and university or unit policy regarding protection and preservation of data.preservation of data.

Towards these ends, faculty, staff and students Towards these ends, faculty, staff and students must share in the responsibility of the security of must share in the responsibility of the security of IT devices.IT devices.

May 17, 2004May 17, 2004

Information Security Policy:Information Security Policy:Obligations of All Users Obligations of All Users

Georgetown: Georgetown: assigns people into four assigns people into four

main groups:main groups:Information Service Information Service Providers Providers

Both central and localBoth central and local

Information StewardsInformation StewardsManagers of UsersManagers of UsersUsersUsers

Defines role of:Defines role of:University Information University Information Security Officer Security Officer Local Information Security Local Information Security PersonnelPersonnel

Cornell: assigns people Cornell: assigns people into five groups:into five groups:

IT Security DirectorIT Security Director Unit HeadsUnit Heads Security LiaisonSecurity Liaison Local Support ProviderLocal Support Provider UsersUsers

May 17, 2004May 17, 2004

Information Security PolicyInformation Security Policy

Georgetown: Georgetown: Security Policy applies to all informationSecurity Policy applies to all information Data policy in progressData policy in progress Defines Defines

classifications of Informationclassifications of InformationRoles Roles ResponsibilitiesResponsibilities

CornellCornell Data explicitly separate from IT security policiesData explicitly separate from IT security policies Data Stewardship and CustodianshipData Stewardship and Custodianship Authentication and Authorization policy does implicate Authentication and Authorization policy does implicate

data, but under the rubric of Data policy.data, but under the rubric of Data policy.

May 17, 2004May 17, 2004

GU’s Information Security PolicyGU’s Information Security Policy

Responsibilities:Responsibilities: Classifying information Classifying information

Separate policy at CornellSeparate policy at Cornell Managing authorization Managing authorization

Separate policy at CornellSeparate policy at Cornell Backing up informationBacking up information

Separate policy at Cornell, and up to the data stewardSeparate policy at Cornell, and up to the data steward Computer security (passwords, antivirus, software Computer security (passwords, antivirus, software

patches, etc.)patches, etc.) Incident reporting and record keepingIncident reporting and record keeping Establishing local security policies and proceduresEstablishing local security policies and procedures

May 17, 2004May 17, 2004

Cornell Data Stewardship and Cornell Data Stewardship and Custodianship PolicyCustodianship Policy

For administrative dataFor administrative data Seven functional areasSeven functional areas

Data stewards required to set policy for Data stewards required to set policy for their own areatheir own area No dispute resolution for cross data usageNo dispute resolution for cross data usage

Custodian ProhibitionsCustodian Prohibitions No changing dataNo changing data No “administrative voyeurism”No “administrative voyeurism” No resolving IP addresses without authorityNo resolving IP addresses without authority

May 17, 2004May 17, 2004

Cornell Policy PromulgationCornell Policy Promulgation

Coordination with central policy officeCoordination with central policy officeEducation Education Forums on each policy, with demonstration of Forums on each policy, with demonstration of

associated software and personnel for proceduresassociated software and personnel for procedures List services to targeted groups, raises lots of List services to targeted groups, raises lots of

questions, gets issues out on the table, especially for questions, gets issues out on the table, especially for people more comfortable with computer for people more comfortable with computer for expression and communication than in a public expression and communication than in a public settingsetting

ImplementationImplementation Always raises new issues, procedures and problems Always raises new issues, procedures and problems

unforeseen in the drafting and promulgation of policyunforeseen in the drafting and promulgation of policyDomain Name as an issueDomain Name as an issue

May 17, 2004May 17, 2004

GU’s efforts to inform usersGU’s efforts to inform users

EducationEducation What is information security?What is information security? Why do we need it?Why do we need it? What’s in the policy?What’s in the policy? What does this mean to me?What does this mean to me? Everyone’s responsibilitiesEveryone’s responsibilities

Excerpts from our “road show”Excerpts from our “road show”

May 17, 2004May 17, 2004

What is Information Security?What is Information Security?

May 17, 2004May 17, 2004

Why we need the policy?Why we need the policy?

May 17, 2004May 17, 2004

What are the goals of the policy?What are the goals of the policy?

May 17, 2004May 17, 2004

More on why we need the policy More on why we need the policy and it’s goals…and it’s goals…

Technical Knowledge Required

Threat Capabilities:More Dangerous & Easier To Use

Sophistication of Hacker Tools

Packet Forging/ Spoofing

19901980

Password Guessing

Self Replicating Code

Password Cracking

Exploiting Known Vulnerabilities

Disabling Audits

Back Doors

Sweepers

Sniffers

Stealth DiagnosticsHigh

Low 2000

DDOS

Internet Worms

© 2001, Cisco Systems

May 17, 2004May 17, 2004

Scare tacticsScare tactics

May 17, 2004May 17, 2004

This one really got them!This one really got them!

May 17, 2004May 17, 2004

Other reasons we need the policyOther reasons we need the policy

May 17, 2004May 17, 2004

A bit about…A bit about…

May 17, 2004May 17, 2004

……a bit more…a bit more…

May 17, 2004May 17, 2004

While we have their attention…While we have their attention…

May 17, 2004May 17, 2004

About the policy itself…About the policy itself…

May 17, 2004May 17, 2004

Who’s whoWho’s who

May 17, 2004May 17, 2004

What it’s all about…What it’s all about…

May 17, 2004May 17, 2004

Now, we got specific…Now, we got specific…

May 17, 2004May 17, 2004

Mantra 2004Mantra 2004

Privacy and SecurityPrivacy and Security

Security and PrivacySecurity and Privacy

Privacy and SecurityPrivacy and Security

Security and PrivacySecurity and Privacy Equally weighted in regulatory legislationEqually weighted in regulatory legislation Complement each otherComplement each other Works with everyone in the community, Works with everyone in the community,

unifies rather than bifurcates.unifies rather than bifurcates.

May 17, 2004May 17, 2004

GU Policy ImpactGU Policy Impact

Made HIPAA, GLBA easierMade HIPAA, GLBA easier

Satisfied external and internal auditorsSatisfied external and internal auditors

Opportunity to educate the communityOpportunity to educate the community

Provides operating frameworkProvides operating framework

May 17, 2004May 17, 2004

CU’s Policy ImpactCU’s Policy Impact

Part of the security program packagePart of the security program package Director level IT Security for entire universityDirector level IT Security for entire university

Part of compliance with federal law and Part of compliance with federal law and regulationsregulationsPart of IT policy frameworkPart of IT policy framework Protecting and preserving university interests and Protecting and preserving university interests and

assetsassets Balancing security and privacyBalancing security and privacy

Part of policy frameworkPart of policy framework Community effortCommunity effort Policy as “citizenship”Policy as “citizenship”

May 17, 2004May 17, 2004

Action AgendaAction Agenda

1.1. Identify Responsibilities and Accountability Identify Responsibilities and Accountability for Information Securityfor Information Security

2.2. Conduct Institutional Risk AssessmentsConduct Institutional Risk Assessments

3.3. Develop Security Policies, Procedures, and Develop Security Policies, Procedures, and StandardsStandards

4.4. Increase Everyone’s Awareness and Increase Everyone’s Awareness and Enhance TrainingEnhance Training

May 17, 2004May 17, 2004

Action Agenda (cont’d)Action Agenda (cont’d)

5.5. Require Secure Products From VendorsRequire Secure Products From Vendors

6.6. Design, Develop, and Deploy Secure Design, Develop, and Deploy Secure Communication and Information SystemsCommunication and Information Systems

7.7. Invest in Staff and ToolsInvest in Staff and Tools

8.8. Establish Collaboration and Information Establish Collaboration and Information Sharing MechanismsSharing Mechanisms

May 17, 2004May 17, 2004

Lessons LearnedLessons Learned

CornellCornell Work procedurally and frame conceptually in Work procedurally and frame conceptually in

the context of one’s own environmentthe context of one’s own environment

Georgetown:Georgetown: Make sure you’ve got the right “usual Make sure you’ve got the right “usual

suspects”suspects” Take the time to achieve consensus or work Take the time to achieve consensus or work

through the issuesthrough the issues Educate the communityEducate the community

May 17, 2004May 17, 2004

SummarySummaryCrisis begets opportunityCrisis begets opportunity

Information Security has become a major opportunity at Information Security has become a major opportunity at universities for leadershipuniversities for leadershipProblems can impact an organization’s reputation, Problems can impact an organization’s reputation, operational responsibilities, and financial healthoperational responsibilities, and financial healthNeeds to be a top IT agenda issueNeeds to be a top IT agenda issueSenior University leadership must be aware of the risks Senior University leadership must be aware of the risks posed by information securityposed by information securityUniversity Information Security Policy enables the University Information Security Policy enables the university to better protect informationuniversity to better protect informationCreates a sense of community: everyone has Creates a sense of community: everyone has responsibilityresponsibilityCreate an awareness in perpetuity Create an awareness in perpetuity

May 17, 2004May 17, 2004

““Bottom line…”Bottom line…”

AllAll users are responsible for users are responsible for protecting information resources protecting information resources to which they have accessto which they have access

May 17, 2004May 17, 2004

ContactsContacts

Ardoth HasslerArdoth Hassler hasslera@georgetown.eduhasslera@georgetown.edu security.georgetown.edusecurity.georgetown.edu Security Officer: Brian ReillySecurity Officer: Brian Reilly

Tracy MitranoTracy Mitrano tbm3@cornell.edutbm3@cornell.edu http://www.cit.cornell.edu/oit/PolicyOffice.htmlhttp://www.cit.cornell.edu/oit/PolicyOffice.html Security Officer: Steve SchusterSecurity Officer: Steve Schuster

Questions?Questions?